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In the aftermath of the space shuttle Columbia accident, it quickly became clear that new 
methods would need to be developed that would provide the capability to inspect and repair 
the shuttle’s thermal protection system (TPS). A boom extension to the Remote Manipulator 
System (RMS) with a laser topography sensor package was identified as the primary means 
for measuring the damage depth in acreage tile as well as scanning Reinforced Carbon- 
Carbon (RCC) surfaces. However, concern over the system’s fault tolerance made it prudent 
to investigate alternate means of acquiring close range photographs and contour depth 
measurements in the event of a failure. One method that was identified early was to use the 
Simplified Aid For EVA Rescue (SAFER) propulsion system to allow EVA access to 
damaged areas of concern. Several issues were identified as potential hazards to SAFER use 
for this operation. First, the ability of an astronaut to maintain controlled flight depends 
upon efficient technique and hardware reliability. If either of these is insufficient during 
flight operations, a safety tether must be used to rescue the crewmember. This operation can 
jeopardize the integrity of the Extra-vehicular Mobility Unit (EMU) or delicate TPS 
materials. Controls were developed to prevent the likelihood of requiring a tether rescue, 
and procedures were written to maximize the chances for success if it cannot be avoided. 
Crewmember ability to manage tether cable tension during nominal flight also had to be 
evaluated to ensure it would not negatively affect propellant consumption. Second, although 
propellant consumption, flight control, orbital dynamics, and flight complexity can all be 
accurately evaluated in Virtual Reality (VR) Laboratory at Johnson Space Center, there are 
some shortcomings. As a crewmember’s hand is extended to simulate measurement of tile 
damage, it will pass through the vehicle without resistance. In reality, this force will push the 
crewmember away from the vehicle, and could induce a moment which, if strong enough, 
could saturate the attitude control system in SAFER. This raises the concern that additional 
propellant will be consumed to maintain controlled flight. To account for this, the fidelity of 
the Virtual Reality simulation was improved to include the effect of crewmember contact 
with the vehicle during SAFER flight. In addition, while participating in VR simulations, the 
subject is in shirtsleeves and sits in a chair. This does not provide a flight-like representation 
of body position awareness. To prevent inadvertent contact with tile or RCC, other facilities 
were utilized to establish crew preferences for body attitude and tool configuration. Finally, 
a study was performed to determine if attitude constraints are needed for the Space Shuttle 
and International Space Station to reduce SAFER flight difficulty. 


I. Introduction 

O N February 1 st , 2003 one Israeli and six American astronauts died when the space shuttle Columbia 
disintegrated during reentry. In August the same year, the Columbia Accident Investigation Board (CAIB) 
issued a report that detailed the cause of the disaster. Insulating foam separated from the external tank and impacted 
the leading edge of the left wing 81.7 seconds after launch. The resultant damage that was caused to the Reinforced 
Carbon-Carbon (RCC)* allowed hot gas and plasma to bum through the left wing during reentry. Loss of attitude 
control and overwhelming stress on the vehicle caused Columbia and her crew to break up over East Texas. 


* EVA Flight Controller/Crew Trainer, EVA Systems Group, 2101 NASA Road One, DX3 

* Manager, Anthropometry & Biomechanics Facility, Habitability & Human Factors Office, 2101 NASA Rd 1, SF3 

* RCC is a composite structure that provides thermal protection for the space shuttle in areas that experience the 
highest heat loads during reentry. It is located on the vehicle nose and wing leading edges. 
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Included in the CAIB report was a number of recommendations that the board suggested be implemented prior 
to returning the space shuttle to flight. One such recommendation was that NASA “develop[s] a practicable 
capability to inspect and affect emergency repairs to the widest possible range of damage to the Thermal Protection 
System, including both tile and Reinforced Carbon-Carbon.” 1 In fulfillment of this recommendation, existing 
inspection methods are being improved and a suite of new techniques are being developed. High-speed video and 
precision radar will be used from the ground. To complement this, NASA’s WB57 high altitude aircraft will record 
video of the shuttle during ascent. Onboard the vehicle, cameras mounted in the external tank umbilical well 5 will be 
upgraded to provide imagery downlink capability for ground analysis during the mission. Crew handheld video 
cameras will film the external tank after separation to try to detect areas of missing foam. Accelerometers are being 
added to all RCC panels in the wings. If an object strikes an RCC panel, the sensors will record an acceleration spike 
significantly greater than the nominal levels seen during launch. While all of these tools help to characterize the 
environment around the space shuttle, the data are indirect indicators of risk. None of these means provide a direct 
indication of the severity of damage that the Orbiter has sustained during launch. These assets can supply the vital 
information that debris was present, its mass properties can be determined, and at best it can indicate that an object 
hit the vehicle. While analytical models can use this information to predict damage, there is always uncertainty in 
the source data and limitations to the applicability of the model itself. The value gained from a direct on-orbit 
inspection of the thermal protection system cannot be understated. The best way to assess the health of the critical 
materials after launch is to look at it. When the size, shape, depth and location of damage is known the capability to 
accurately predict the survivability of reentry improves. 

One of the largest obstacles faced when attempting to inspect the space shuttle thermal protection system is that 
the majority of the surfaces are obstructed from the view of the crew cabin and robotic arm. In addition, traditional 
EVA handholds and translation aids do not exist near TPS surfaces making it impossible to send a person to the 
location using existing means. Because of this, new hardware and procedures are being developed to support the 
shuttle’s return to flight. The most radical change is the addition of the Orbiter Boom Sensor System (OBSS). This 
hardware consists of a sensor package mounted on the end of a long pole. When attached to the existing robotic arm, 
the OBSS will have visual access to otherwise obscured locations. The sensor system will provide real-time, two- 
dimensional video. In addition, the data from a scanning laser can be used to map the surface such that three- 
dimensional contours of any damage can be recreated on the ground**. Unfortunately, performing scans with the 
OBSS is a major impact to the mission timeline. Therefore, it is impractical to examine the entire vehicle with 
OBSS. Because the greatest aerodynamic and thermal demands are placed on RCC, the inspection requires the 
highest resolution that only the OBSS can provide. The robotic arm will grapple the boom to perform a full day 
inspection of the RCC on both wings and the nose cap.^ 

The short duration of a space shuttle mission does not make an OBSS scan of all TPS surfaces realistic. 
Effectively the majority of on orbit time would be spent scanning tile and all mission goals and utility would be lost 
if this were attempted. Fortunately the Orbiter can tolerate larger damage to the vast majority of tiles on the lower 
surface of the vehicle compared to RCC. The area of black tile that comprise the shuttle’s lower surface is referred 
to as acreage tile. This greater damage tolerance permits the resolution requirements for imagery of acreage tile to be 
met with a digital camera held by the International Space Station (ISS) crew. As the shuttle approaches ISS, it will 
present its underside to the space station crew during what is known as the Rendezvous Pitch Maneuver (RPM). At a 
range of approximately 600 feet, the acreage tile will be exposed for 93 seconds of photography. 

To close out the on-orbit inspection, the preexisting end effector camera on the space shuttle’s robotic arm will 
be used to capture close-up video of the crew cabin. From the aft flightdeck, a handheld digital camera will 
photograph the vertical stabilizer and Orbital Maneuvering System (OMS) tiles. If damage is observed here, or 


5 During ascent, two doors on the underside of the space shuttle are open to allow umbilicals to supply liquid 
hydrogen and oxygen from the external tank to space shuttle main engines. Imagery from this location is desired 
because ice debris is often generated from the cryogenically cooled lines and it provides views of the external tank. 

** There are several benefits to 3-D data as opposed to 2-D images. The amount of material remaining in a location 
can aid in predicting if plasma will bum through to the aluminum structure. It may also be possible to predict if the 
perturbations to the airflow are great enough to cause a transition from laminar to turbulent flow. Early transition to 
turbulent flow can cause large increases in downstream heating of the Orbiter. 

At time of print, a goal of the first two shuttle missions after the Columbia accident is to better characterize the 
nominal signatures of the wing leading edge accelerometers and to demonstrate that external tank redesigns have 
sufficiently reduced debris shedding. If this is successful, subsequent flights will not map the RCC surfaces with 
OBSS. Rather a point inspection would be performed in areas of concern indicated by the accelerometers or other 
imagery assets. 
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during the Rendezvous Pitch Maneuver, the two-dimensional imagery may be insufficient to determine if damage is 
survivable. If suspicious damage brings the safety of the crew into question, time has been reserved to perform an 
additional OBSS point inspection at these locations. This would provide the three dimensional information required 
for TPS experts to make the most informed reentry decision. 

When all the inspection plan pieces described above come together, the recommendation of the CAIB report is 
satisfied; all critical TPS components can be viewed with adequate resolution. If history can be any guide, we must 
recognize that space flight hardware does not always operate as planned on its maiden voyage. Inevitably, NASA is 
forced to prepare for the possibility that hardware’s unexpected ‘features’ may prevent it from delivering the desired 
results. There are OBSS and robotic arm components that are zero fault tolerant; a single failure in these systems has 
the potential to deny inspection capability with the boom. In some cases the sensor may be inoperable, while other 
failures may completely prevent removal of the boom from its launch location. Although it is less, the RPM 
photography of the acreage tile is not without risk either. The sun and Earth must be in proper alignment to obtain 
the necessary lighting conditions. The predicted window of opportunity to capture all images is 93 seconds. Because 
these pictures are taken with a handheld digital camera, it is possible that the crew will not obtain photographic 
coverage of the entire surface. Regardless of the particular chain of events and anomalies that come to pass, many 
circumstances necessitate an alternate method of inspection. 

When a backup system is chosen, it must function independently of the failures that would require its use. 
Therefore, a prerequisite of the contingency inspection method is that it operates without the OBSS. Any robotics 
operations must be able to be performed using either space station’s (SSRMS) or shuttle’s (SRMS) robotic arm. 
Considering these limitations, it was decided that EVA techniques should be developed for sending a person to 
examine the thermal protection system. At fist glance, it would seem that utilizing the same methods that allow a 
crewmember access to repair damage could also place them in close proximity for detailed inspections. In fact, this 
is not the case. If damage is located outside the reach of either robotic arm, the instability of the boom as a work 
platform may make repair impossible from this location. If this is the case, the space shuttle would be required to 
perform the Orbiter Repair Maneuver (ORM). This is a three-day operation in which the space shuttle undocks from 
ISS and uses the SRMS to present its underside to EVA crewmembers on the SSRMS. The hazards associated with 
this procedure place both the vehicles at risk and a tremendous amount of time is required for execution. 
Consequently, different ways are needed for EVA inspection access than those used for repair. 

The backup inspection method used is very dependent upon the damage location. In many circumstances, the 
simplest approach is the best. If the damage to be inspected can be reached by a crewmember on the end of a robotic 
arm, then this is clearly desired. A foot restraint on the robotic arm is stable and secure. Additionally, there is 
extensive flight experience with this configuration. Moreover, several tools can be stacked on the end of the arm to 
extend the crewmember’s reach. In addition, it is possible that the backup inspection is only required because the 
OBSS sensor package failed. The boom itself might still be available. If so, consideration will be given to an EVA 
inspection based off the boom’s end. 

There are scenarios that preclude EVA inspection from a robotic platform. Quite simply, the boom could be 
unavailable and the damage beyond the range of other robotic and EVA tools. Similarly, on a flight specific basis, 
there may be a prohibitive amount of overhead involved in relocating space station hardware for use in this task. 
Even if the boom was available, dynamic analysis may indicate that flexure and instability with a 680-pound 
crewmember on the boom could risk further damage through secondary impacts to the shuttle. A new method must 
be available to extend the reach of EVA crewmembers. 

During the conceptual stages of the International Space Station, it was recognized that there would be no way to 
fly after, and retrieve an EVA astronaut who had suffered a failure of their safety tether and become separated from 
structure. During stand-alone Space Shuttle missions, like those to repair the Hubble telescope, the Orbiter could 
chase down a stranded crewmember. This is not possible for EVAs conducted on ISS. The solution was to develop a 
self-contained propulsion system that could be attached to the space suit. In the event that an astronaut separates 
from station, they could activate this jet pack and rescue themselves by flying back to the vehicle. The propulsion 
system that was built is called the Simplified Aid For EVA Rescue (SAFER). It is now worn on every EVA 
conducted from the space station. What if it were used to fly away from solid structure rather than exclusively as a 
rescue tool to return to it? If this is done, EVA crewmembers could fly to the lower surface of the space shuttle to 
conduct a detailed inspection and then return safely. Herein lies a backup method to satisfy the on-orbit inspection 
recommendation of the CAIB report. 
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II. SAFER System Description 

In order to understand the challenges facing the use of SAFER as an Orbiter inspection tool, it is first necessary 
to become familiar with the existing system design. SAFER is a cold gas system that provides six degrees-of- 
freedom in translation and rotation. This allows a pilot to fly up and down, left and right, forward and backward. 
Roll, pitch and yaw rotations are also possible. SAFER attaches to the 
life support backpack of the Extravehicular Mobility Unit (EMU), or 
spacesuit. By sliding a lever up, a stowage tray containing the SAFER 
Hand Control Module (HCM) is deployed and swings to the front of the 
crewmember. Grasping the HCM with two hands, the astronaut can 
control flight using a four degree-of-freedom joystick mounted on its 
right side. Thrust is achieved by flowing pressurized gaseous nitrogen 
through any of the twenty-four jet nozzles on SAFER. 

The nitrogen propellant is stored in a tank that is pressurized to 8000 
psi. This quantity of gas is capable of accelerating the 680 pound 
combined weight of a crewmember and EMU to a speed of 1 0 feet per 
second. SAFER also has the capability to stabilize the crewmember’s 
attitude. This is accomplished with a three-axis fiber optic gyroscope 
that measures rotational velocities in roll, pitch, and yaw. Control 
software uses the signals from the gyroscopes and commands particular 
thrusters to fire and neutralize rotation. This functionality is called 
Automatic Attitude Hold (AAH). Power is provided to the thruster 
valves, avionics, and HCM from a dedicated battery. Power and propellant are limited resources on the SAFER. A 
small display on the HCM allows the crewmember to monitor the remaining quantity of these consumables. 

When existing hardware is to be used in a role for which it was never intended, it is important that the 
performance requirements to which it was designed are compared to those that it will be expected to fulfill. If the 
demands of the new task cannot be met with the existing equipment, then hardware may need to be modified. In 
some cases however, the hardware has more capability than its original certification suggests. If this is the case, it is 
necessary to prove that new tasks actually are within the hardware’s capability and the certification should be 
updated. SAFER rescue operations are significantly different from Orbiter inspection. Where rescue flights only last 
1 3 minutes, inspection requires up to forty-five minutes of flight time. Another difference is that an astronaut using 
SAFER for rescue uses two hands to operate the hand controller; one hand manipulates the joystick while the other 
holds the HCM steady. Conversely, inspection requires that both a digital camera and depth gauge be used while 
operating the hand controller. This dictates that the HCM be rigidly secured in front of the crewmember to enable 
one-handed operation. A final subtle distinction between the two uses of SAFER relates to fault tolerance. EVA 
hardware is required to be single fault tolerant. This means that no single failure of hardware can jeopardize crew 
safety. However, hardware is not required to be safe in the event of any two failures. During an EVA, the spacesuits 
are always double tethered to the vehicle. Before a SAFER rescue is needed, two tether failures would have to 
occur. With this in mind, SAFER system redundancy was not required**. This means that a single failure could 
render it useless. Alternatively, an inspection flight would be performed without any existing failures in EVA 
hardware. Essentially this means that crew safety would be dependent upon a device that may not operate after a 
single component failure. The existing safety tether is only 55 feet long, which is too short to be used as an 
additional level of protection for SAFER flights to remote damage locations. In order to regain the mandatory 
redundancy, a new 85-foot safety tether has been designed for SAFER inspection. However, tethered flight raises 
new safety concerns as will be discussed in the following section. 

III. Problem Description 

While considering the new requirements that vehicle inspection imposes on SAFER, several problems were 
identified that would require resolution before flight use of the hardware. The questions that raised the greatest 
concern are identified here. 


** The SAFER is a simplified design based upon the Maimed Maneuvering Unit (MMU). The MMU was single fault 
tolerant, however, the redundancy came at the price of prohibitive size. In order for the SAFER to be reduced to a 
practical size for standard use, fault tolerance was sacrificed. 



Figure 1. SAFER attached to EMU 
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A. Risk of Safety Tether Rescue 

Adapting the application of existing SAFER hardware to satisfy a new mission requires the use of a safety 
tether during flight to retain the necessary fault tolerance. However, if controlled flight capability is lost and it 
becomes necessary to retrieve a stranded crewmember by retracting the tether, new risks are created. Probably the 
most disconcerting is the result of conserved angular momentum. Angular momentum can be expressed as: 

L^RxMV (1) 

In Eq. (1), the mass of the EMU, M, is constant. The distance between the SAFER pilot and the point at which their 
safety tether is attached to the robotic arm is written as R. The linear velocity of the crewmember is expressed as V. 
Equation 1 can be simplified by replacing V with the component of the velocity that is perpendicular to the vector R. 

L= RMV sin 6 (2) 



Theta is the angle between the V and R. Because angular momentum is conserved, L at the time of SAFER 
failure (t = 0) must equal L after the tether has been retracted (t = 1). Therefore, Eq. (2) can be written: 

R 0 V 0 sind 0 = RjV , sind, (3) 

The implications of this are severe for SAFER rescue. A slowly moving crewmember at the end of an extended 
tether would be accelerated far beyond the EMU impact certification limits after being pulled toward the robotic 
arm. How can the safety tether be relied upon as a level of fault tolerance if its use could risk catastrophic damage to 
the spacesuit or Orbiter? 

The danger of safety tether retrieval can be reduced two ways. As long as flight control can be maintained, the 
operation is not required and the hazard can be avoided. Second, if control is lost and a tether retrieval must be 
performed, every reasonable effort must be made to make the procedure as safe as possible. The fundamental causes 
of lost control are uncommanded thruster firings, failure of thrusters to fire when needed, loss of propellant, and 
inadequate piloting skill. Analysis, testing, and operational procedures are needed to keep this risk as low as 
possible. One of the most significant concerns surrounding SAFER use for inspection involves the longer duration 
flight. For a rescue scenario, the hardware was only designed and certified to operate for a minimum of thirteen 
minutes. During TPS inspection there may be multiple locations that need investigation. Each of these sites would 
require photographs, and depth measurements may also be needed. The necessary time to complete these tasks is 
significantly longer. The actual hardware capability had to be known in order to define the allowable flight duration 
before a system failure could cause loss of control. Each individual SAFER component was scmtinized to determine 
its operational life in the worst-case temperature extremes. Battery capacity was tested to ensure adequate power 
was available to support longer missions. This analysis revealed that the limiting component is the fiber-optic 
gyroscope used to stabilize the attitude. After forty-five minutes of powered operation, these components could 
overheat and fail. A further probabilistic risk assessment was conducted to quantify the risk of a random hardware 
failure within this forty-five minute window that would cause a loss of control. 

In addition to hardware analysis, testing was needed to quantify the risk of human error. Ever since SAFER’s 
beginning, a large variation in crewmember piloting skill has been observed. This is evidenced by the propellant 
consumption and the time required to perform a successful rescue during training sessions in Johnson Space 
Center’s Virtual Reality (VR) Laboratory. During a rescue, 100% of the available propellant could be used to 
complete the mission. It was not necessary to preserve any gas for subsequent operations. For an inspection task the 
crewmember needs to fly away from the robotic arm, photograph and measure the damage depth, and then either 
proceed to a second damage location or return to the arm. It is necessary to set limits on remaining propellant and 
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flight time. These bounds would be set such that if they were ever reached, adequate margin would remain for the 
crewmember to safely return to the robotic arm. How should these limits be set? Because rescue and inspection 
missions are so different, there was not any previous experience applicable for defining these limits. Furthermore, 
because crewmember capability varies, the limits must be sufficiently conservative such that any astronaut 
performing the task will be able to reach safety every time. 

B. Effects of Vehicle Contact Forces 

Ground based tests of flight hardware are often limited in realism because they lack both the vacuum and 
weightlessness of space. Because of this, the most realistic simulation of SAFER flight is achieved in a virtual 
reality laboratory. Only here can the performance characteristics of the jets and attitude control system be modeled. 
This also allows the crewmembers to see a visual image of ISS and the space shuttle. Unfortunately, the virtual 
environment is not without problems. Because the vehicles are only represented by graphical models, they provide 
no resistance during contact. This means that it is possible to fly through solid structures in the VR lab. The 
implications of this are significant for inspection flight studies. As previously discussed, it will be necessary to 
measure the damage depth. This will be accomplished during the SAFER inspection by spanning the damage with a 
contour gauge. The distance between the base of the tool and tile surface is then measured. A necessary condition 
for operation of the depth gauge is that it contacts the healthy tile surface on either side of the damage. In orbit, this 
contact will impart a reaction force into the EMU. However, in the VR lab the tool simply passes through the 
vehicle without affecting flight. In order to quantify accurately the amount of propellant needed for inspection, the 
reaction force cannot be neglected. The crewmember may need to expel additional gas to maintain their position in 
front of damage so that multiple measurements can be taken. In addition, if the tool is held far from the EMU’s 
center of gravity during contact, it is unknown if the resultant moment could create a large angular displacement 
before the attitude control system could stop rotation. If this were to happen, considerable propellant would be 
consumed during recovery. In the worst case, crewmember disorientation could jeopardize safety. A new method 
needed to be developed for analyzing the effects of these reaction forces. This is complicated by human-in-the-loop 
damping actions of the person’s arm that holds the tool. 

C. Body and Tool Position Awareness 

Many simple skills are often taken for granted before donning an EMU. Without looking, people are aware of 
the locations of their body parts. This becomes much more difficult in a spacesuit. The added volume of the 
spacesuit and accompanying tools, combined with a very restricted field of view, makes it difficult to know how 
much clearance exists between one’s EMU and nearby objects. Although TPS materials can withstand some light 
contact, accidentally kicking tiles or RCC could certainly cause unwanted collateral damage. Is there a body position 
that keeps damage within measurement reach, but also provides adequate sensory cues to assure the crewmember 
that they are not at risk of unintentionally contacting the Orbiter surface with stray tools and suit parts? 

D. Safety Tether Slack Management 

Although a safety tether is needed in the event of a SAFER failure, during nominal flight operations the effects 
of the tether must be minimized. Any tension on the tether cable will impart an unbalanced pull on the EMU. This 
force will create unwanted motion unless it is counteracted by thruster firings. When this happens, nitrogen 
propellant is wasted. If left untended, the safety tether would continuously tug on the EMU because the safety tether 
reel is built with an internal torsion spring that automatically retracts loose cable. To minimize this effect, the second 
EVA crewmember will be positioned in a foot restraint on the end of the robotic arm. During inspection, this 
crewmember will have the responsibility of managing cable slack. This job entails pulling cable out of the reel as the 
crewmember flies away, and then feeding it back into the reel housing as the SAFER returns. Slack must be 
controlled such that tension is kept to a minimum, yet there is not a risk of entanglement in loose cable. It was 
unknown if the tension could be kept low enough to avoid affecting SAFER flight control. It was also unclear if the 
astronaut managing the tether would be able to perceive when the proper amount of slack is achieved. While this 
might be simple in a 1-G environment by observing the sag in a loose cable, zero-G removes this visual cue. 

E. Effects of Vehicle Attitude and Orbit 

When the concept of using SAFER for inspection was first conceived, it was recognized that there could be 
prohibitive flight complexity added depending on the docked Space Shuttle and ISS attitude. The standard attitude 
for the docked vehicle is a type of Local Vertical Local Horizontal (LVLH) orbit. In this attitude, the orientation of 
the vehicle with respect to the Earth remains constant throughout the entire orbit. 


6 

American Institute of Aeronautics and Astronautics 



Figure 2. Example of LVLH orbit. 


Conversely, the SAFER maintains an inertial orbit because the three internal gyroscopes hold the attitude fixed 
in space regardless of location in the orbit. 



Figure 3. Example of inertial orbit 

In very simplistic terms, the difference in orbit types cause the SAFER pilot to perceive that the vehicles rotate 
360 degrees over the course of one orbit. Would this relative rotation equate to high propellant consumption as the 
astronaut attempts to maintain a consistent attitude for inspection? If this action increases SAFER flight difficulty, 
then the possibility of human error also rises. If so, this may dictate that the Space Shuttle transition to a similar 
inertial attitude for the duration of SAFER inspection. While this would be possible, it does add mission complexity 
and undesirably heats localized areas of the ISS thermal control system. 

IV. Testing and Analysis 

With crew safety being of primary concern, there was a long road to be traveled before SAFER could be 
considered an acceptable means of inspection. If any of the problems previously discussed could not be resolved, 
then a substitute method of Orbiter examination would be required. The conundrum lies in the fact that there is no 
perfectly analogous test environment on the ground. SAFER performance is dependent upon both zero-G and 
vacuum. In order to find solutions to all the problems, it was first necessary to identify the critical factors that affect 
each specific issue. Ground based tests could then be developed which adequately simulate the important elements 
of each concern. Following is a description of the tests and analysis performed. 

A. Risk of Safety Tether Rescue 

Much to the chagrin of the SAFER inspection team, no hardware modifications or elaborate tests will provide a 
means to violate the laws of physics. Angular momentum will always be conserved and the associated risk of tether 
retrieval cannot be eliminated. Furthermore, the single string SAFER is not immune to failures which would 
necessitate a tether rescue. Therefore, no amount of work will ever be able to remove all the risk of an uncontrolled 
EMU catastrophically colliding with structure. 
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Table 1. Test plan for consumable limit study. 


In addition to the hardware analysis described previously, 
the likelihood of pilot error preventing controlled flight back 
to the robotic arm is controlled by establishing conservative 
limits on consumables. The Virtual Reality Laboratory was 
recognized as the only suitable location to evaluate flight 
skill and consumable expenditure. The simulation models 
SAFER performance, orbital dynamics, vehicle 
configuration, and depth perception with excellent accuracy. 

Extremely high confidence is needed in any consumable limits that would be set. If one astronaut ever ran out of 
propellant, a safety tether rescue would be required. This is undesirable considering the danger of relying on the 
safety tether. Because piloting skills improve with practice and currency, it was necessary to develop a test that 
removed the effects of learning 55 . Table 1 shows the two scenario, four period test plan that was chosen for this 
quality. Without this, the subject would show increasingly efficient skill during repeated simulations. This would in 
turn bias the results toward a lower propellant and time margin of safety. Eight astronaut test subjects were chosen, 
each with varying levels of SAFER training, so that every series could be duplicated once. 

In this test, scenario A involved having the SAFER crewmember originate at the SRMS and fly to two simulated 
damage sites. At each location, the crew would achieve a stable hover between 5 and 15 feet away from the tile 
surface. This distance has previously been identified as the range that provides the desired image resolution for 
digital pictures with a 50mm lens. The pilot would then slowly approach the tile surface and hover within arms 
length such that the handheld contour gauge could measure depth cross sections. Scenario B was identical to A 

except three inspection locations were visited. If this were 
performed in flight, the second crewmember on the SRMS 
would be able to provide additional situational awareness 
through voice communication. Likewise, while utilizing a 
simulated view from the second crewmember in the VR lab, 
the test conductor was able to provide verbal assistance 
during the test. 

For data collection, each scenario was divided into similar 
tasks. Gross translations included the flight between the 
SRMS and damage sites, as well as the motion from one 
damage location to the next. Approach tasks involved the 
more precise flight from the photography location to the 
vehicle surface for depth measurement. Thus, scenario A 
included three gross translations and two approaches whereas 
scenario B contained four gross translations and three 
approaches. For each task, propellant consumption and 
elapsed time was recorded. 

The second aspect of risk reduction for tether retrieval involves safe procedure development. Testing this 
operation proved extremely difficult due to the limitations of the available facilities. The crewmember positioned on 
the robotic arm needs to tug on the tether cable to pull the stranded pilot to safety. The VR lab cannot model this 
particular force feedback problem accurately. A preliminary test was conducted on the Precision Air Bearing Floor 
(PABF). This facility offers virtually friction free motion in one plane by elevating support sleds on a cushion of 
pressurized air. A tether was connected to a sled with similar mass properties as an EMU and then test subjects 
pulled the cable. Unfortunately, the PABF test proved to be inconclusive because the floor limits motion to two 
degrees of freedom. The test was repeated onboard NASA’s KC-135 aircraft. This plane flies a series of parabolic 
trajectories at the top of which twenty seconds of zero-G can be experienced. For this test, a free-floating test subject 
with an additional 400-pound mass simulator was located on the end of the extended safety tether. A stationary 
crewmember held the tether reel fixed in place. Subtly different retraction techniques were tested in hope of 
determining which method provided, the greatest control"". As was expected, there were aspects of the KC-135 test 



Figure 4. Simulated tile inspection in VR lab. 


55 Although crewmembers generally receive proficiency SAFER training during the week of quarantine prior to 
launch, this is not always achievable. In some cases up to a month may have elapsed between the last training and 
flight. Because of this, the benefits of recent training were not desired for setting consumable limits. 

*** Variations included: Fixed crewmember initiating pull, free-float crew initiating pull, controlling trajectory by 
pulling cable to one side, tether connected at location of free float crew’s EMU D-ring or held so tension is directed 
through center of gravity. 
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that did not accurately represent flight. The most significant was the limited size of the cabin. The test subject would 
hit a wall after floating five feet, whereas an EVA crewmember could swing out an 85-foot arc on orbit. 


B. Effects of Vehicle Contact Forces 

There are several complex factors influencing the resultant crewmember motion after contacting the vehicle. 
This meant that simple conservation of momentum calculations would not suffice for determining flight 
controllability and propellant consumption. The need to include the effect of the SAFER attitude control system as 
well as astronaut piloting skill meant that the final evaluation would need to be performed in the Virtual Reality lab. 
However, it is equally important to include an accurate representation of the contact pressure, duration, and location 
with respect to the EMU’s center of gravity. These are all going to be affected by depth gauge ergonomics, 
measurement technique and crewmember range of motion in the spacesuit. The VR lab is not an ideal environment 
for evaluating these aspects. 

Two methods were conceived to create a marriage between the virtual reality simulation and measurement 
reaction forces. The first involved a series of tests on the Precision Air Bearing Floor and onboard the KC-135 
aircraft. Crewmembers were suited in an 
EMU and slowly pushed toward a 
damaged tile board to simulate SAFER 
flight approach for measurement. A 
prototype depth gauge tool was used in 
which a pair of single axis load cells 
would continuously monitor the 
compression force during the 
measurement process. Figure 5 shows a 
preliminary version of the depth gauge 
with the integrated load cells. The total 
force exerted by the crewmember during 
depth measurement was obtained by 
summing the force registered by each load 
cell. Several plots of force over time were 
created as crewmembers measured 
damaged tile with various initial flight 
velocities. 

The end goal was to take the forces recorded during actual suited depth measurements and include them in the 
Virtual Reality simulation. When the virtual tool makes contact, the Orbiter would impart the reaction force seen 
during testing. The force plot corresponding to the approach speed that most closely matched that flown in the 
simulation could be applied. 

The KC-135 aircraft is by nature a dynamic test bed. The most subtle non-zero G forces and flight turbulence 
can impart unrealistic motion that can corrupt data. A quantitative means of filtering out the bad data was needed. 
Hence, the Anthropometry and Biomechanics Facility (ABF) at Johnson Space Center employed a three- 
dimensional, video based, motion analysis system called Vicon. This system was used to capture the movement of 
the EMU in relation to the damaged tile area thereby, allowing particular test cases most closely representative of 
flight conditions to be selected. A synchronization signal was used to match the motion analysis data with that from 
the load cells. This was necessary to differentiate the accelerations caused by tool contact from those due to outside 
factors such as turbulence or contact with the test director. 

The Vicon system includes an array of ten video cameras, each of which is surrounded by LEDs. Light from the 
LEDs is reflected off markers strategically positioned on the EMU and the tile surface and is then capture by the 
camera lens. From this signal, the distance from a camera to each marker is determined. The position in three- 
dimensional space is calculated by triangulating the information from all ten cameras. By applying calibration and 
reconstruction algorithms, a digital model of the spacesuit motion is created. Marker positioning was chosen to 
focus on the location of the depth gauge, helmet, boots, and center of gravity (CG). Figure 6 shows the test setup on 
the KC-135. The following information was obtained during each test case. 

■ EMU CG trajectory through the X-Y and X-Z planes 

■ EMU CG linear speed 

■ EMU pitch and yaw angle with respect to tile surface 

■ EMU angular velocity about the yaw and pitch axes 



Figure 5. Prototype depth gauge during a test on the KC-135. 
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The motion analysis combined with standard video footage 
filled another critical role in the overall test integration. After 
including the force data in the virtual reality laboratory, the 
simulation was tested and the resultant motion was compared to 
that seen on the KC-135. Without the influence of SAFER’ s 
attitude control in the aircraft tests, rotation caused by the 
contact would be greater than that in the VR lab. Similarly, the 
magnitude of the linear accelerations should be approximately 
equal in both locations. If major differences were observed in 
the VR simulation, this would indicate that sources of error 
were, large enough to affect the model accuracy ttt . If this 
approach to upgrading the VR simulation created unrealistic 
motion during tile contact, it would need to be abandoned in 
favor an alternative. 

The second method that was developed for modeling the 
effects of vehicle contact utilized a robotic force-feedback 
system in the Virtual Reality Lab. Previously this tool was used 
to simulate the dynamics of large mass handling during EVAs. 
The robot is named Charlotte because it is suspended by a 
spider-like web of eight cables, each connected to a motor- 
controller. Four sensors on Charlotte measure torque and force 
applied by a crewmember. The output of these sensors is fed 
into a simulation that then drives the motors to adjust the cable 
length and move the robot. The model can be modified so that 
the mass properties of the object being manipulated can be 
controlled. Thus, if Charlotte were used to represent a massive 
object, a crewmember would find it harder to move than a 
lighter one due to the high inertia. 

Adapting Charlotte for use during SAFER flight had not been attempted previously. The robot was made to 
represent an area of the Space Shuttle’s tile surface. To aid in visualization, a photograph of damaged tile taken after 
the STS-27 mission was mounted on Charlotte’s front surface. During SAFER flight in the VR lab, the astronaut is 
constrained to sit in a chair. Rather than the EMU being pushed away from a stationary Orbiter, the model had to be 
built so that the vehicle moved away from the motionless pilot. This is acceptable because the relative motion 
between the two is the same either way. If these modifications were made successfully to the simulation, Charlotte 
would physically move toward the crewmember as they flew SAFER towards the virtual vehicle. When the 
astronaut reached out their hand to take a depth measurement, Charlotte would sense the contact and react 
accordingly. 


Figure 6. KC-135 test configuration. 


C. Body and Tool Position Awareness 

A limitation of the VR lab is that the SAFER pilot cannot get a representative understanding of their body 
position. While wearing shirtsleeves, it is impossible to make any conclusions about how well one would perceive 
their EMU’s proximity to the shuttle. This can only be determined while inside an EMU. Suited evaluations are 
commonly conducted in the Neutral Buoyancy Laboratory (NBL). The underwater environment is the best location 
for simulating prolonged weightlessness for EVA training and tests. Support divers held two astronauts, outfitted 
with the complement of tools needed for inspection, next to a simulated tile surface. The crewmembers’ bodies were 
then pitched through a range of angles with respect to the tile until acceptable body positions could be enveloped. If 
the pitch angle was too low, the crew became concerned about accidental boot and tool contact. At high pitch 
angles, helmet contact and operation of the contour gauge became the concern. Although this was useful for 
determining the rough range of acceptable positions, the information could not be depended upon. In the NBL, 
proper buoyancy is achieved by attaching leg weights to the spacesuit. This has the effect of pulling the boots 
towards the pool floor and straightening out the legs. In addition, the training suits are not as stiff as the flight units 
due to the frequency of use and constant exposure to water. The consequence of these differences is that the knees 
and boots do not extend as far in front of the astronaut in the NBL. By reviewing previous flight photos, it was 


m Possible sources of error include load cell accuracy, aircraft accelerations, and differences between simulated and 
flown EMU mass properties. 
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possible to determine the EMU’s neutral joint angles. A 
comparison of NBL and flight leg positions is shown in 
Fig. 6. 

The challenge now became how to constrain the leg 
joint angles to match flight positions. This objective was 
captured during the dry run test of the Vicon motion 
analysis system on the Precision Air Bearing Floor 
(PABF). Because body pitch is the most relevant in 
selecting an attitude for measurement, a pair of sleds 
was built to hold an EMU on its side. This provided 
unencumbered motion about the pitch axis. The two 
sleds constrained the EMU legs such that the joint 
angles matched those seen on orbit. Again, the 
crewmembers were positioned in front of a tile board at 
various angles until they could determine their comfort 
zone. An overhead camera was used to measure the 
pitch angle once the preference was formed. In addition, 
a load cell was located behind the tile board to record the magnitude of any inadvertent contact that might occur 
during damage inspection. If it turned out that accidental contact was unavoidable, this force data would provide a 
means for determining if tiles would be damaged. 


Figure 7. NBL and flight EMU joint angles 



Figure 8. EMU secured on sleds during PABF testing. 


D. Safety Tether Slack Management 

Safety tether slack control is necessary for efficient SAFER flight. Any nitrogen propellant that is spent 
counteracting the cable tension becomes unavailable as safety reserves. A test is needed to determine how well a 
crewmember can control the safety tether cable with cumbersome EMU gloves. All 1-G tests are invalid due to the 
added tension caused by cable sag. In addition, it is equally important to find out how well the crewmember can 
perceive that the cable is slack enough to avoid pulling on SAFER, yet controlled enough to prevent entanglement. 
Unlike zero-G, gravity creates a consistent bow in the tether that invalidates any tests that attempt to model the 
visual cues. 

The necessity of a zero-G environment meant that the KC-135 aircraft was the only adequate testing facility. 
One test subject representing the crewmember in the arm’s foot restraint stood in a fixed location. This person wore 
EMU gloves while extending cable from the tether reel as needed. A second subject representing SAFER, floated 
down the cabin while holding a force gauge in-line with the cable end. The SAFER subject limited their speed to 
less than one ft/s. While this speed is actually orders of magnitude faster than that planned for flight operations, the 
difference will only add conservatism to the results. This is because the faster speed during testing makes it harder to 
control the cable and is more likely to induce tension; flight forces would be more benign. During the tether 
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extension, average tension was recorded as well as the peak force. Although it was expected that the tension would 
be trivial, if significant forces were measured they could be incorporated into the virtual reality simulation for 
further study of propellant impacts. 

E. Effects of Vehicle Attitude and Orbit 

As has been discussed, an EVA crewmember will face the challenge of maintaining a consistent attitude with 
respect to the Orbiter. This is crucial for avoiding unwanted contact with TPS material. The virtual reality laboratory 
was chosen to test what effect the Shuttle and ISS attitude have on the SAFER inspection difficulty. Because 
SAFER uses an inertial attitude hold, it was expected that frequent yaw and pitch corrections would be necessary 
when the vehicles were flying an LVLH attitude. The consequences of the additional corrections had an unknown 
effect on SAFER consumables. 

A VR lab test was developed which compared inspection missions 
with the vehicles in both LVLH and inertial orbits. For the both cases, 
standard docked vehicle attitudes were used. Six subjects performed 
the inspection cases as described in table 2. 

During the test, propellant consumption and elapsed time for 
each stage of flight was recorded. In addition, subjects were asked to 
describe their perception of the flights so that a qualitative 
comparison of the difficulty could be understood. Table 2. Orbit tvpe imnact test plan. 

V. Results 

Like the slow assembly of a jigsaw puzzle, each test added a small piece in the overall understanding of the big 
picture. At any point, a single negative result could have threatened the project and left the Space Shuttle Program 
without the option of using SAFER for vehicle inspection. The test results for each issue are summarized here, 

A. Risk of Safety Tether Rescue 

The purpose of the different consumable limits was the key factor in deciding amount of statistical confidence 
desired. SAFER control may be lost if the propellant is consumed or if the unit is powered on for more than forty- 
five minutes. The paramount concern is to preserve ample nitrogen and operational time so that the astronaut can fly 
back to the safety of the robotic arm. This task is the same as one gross translation performed in the VR lab tests. 
Because it is so important that this phase of the flight is successful, 99.9% confidence was chosen for establishing 
the limits. Statistically this means that pilot error will only necessitate a safety tether rescue once in a thousand 
inspections. The desired level of confidence is achieved by reserving 22% of the nitrogen and 13 minutes for the 
return flight. However, thruster performance is degraded when the propellant tank approaches empty. Thus, it was 
decided that the SAFER pilot shall discontinue all inspection work and fly back to the arm if the remaining 
propellant reaches 30%. 

Space Shuttle flight history has seen as many as 298 dings on tile that were larger than one inch. It stands to 
reason that future missions may require detailed inspection of multiple locations. A second limit must be established 
for these situations. After completing a damage inspection, the astronaut must decide if they should return to the arm 
or proceed to the next examination site. The remaining propellant may be above 30%, however it would be foolish 
to attempt another inspection if it were insufficient to complete the task before reaching this limit. Before 
committing to this undertaking, the crewmember must be reasonably sure that they have time and propellant suitable 
for completing the job. Additional inspections require two gross translations and one approach to complete the task 
and return to the arm. Based on the VR tests, this can be achieved with 99.0% confidence when at least 45% 
nitrogen remains and when the elapsed time since powering on SAFER is less than 23 minutes. Even if the decision 
is made to proceed to another location, that inspection will be aborted if the nitrogen level drops below 30% or the 
elapsed time is greater than 32 minutes. 

It is important to recognize some factors that affect the accuracy of these results. First, the crewmembers that 
were selected as test subjects were only required to have generic SAFER training. Flight assigned crews will receive 
significantly more training to prepare them for potential SAFER TPS inspections. A second factor is that test 
development for all of the problems covered was happening in a parallel timeframe. The implementation of 
Charlotte to model vehicle contact forces was not complete until after all consumable testing was complete. This 
creates a low bias on the propellant used during the approach flight segment. This is considered acceptable because 
the 30% limit that protects crew safety is not based upon the approach data. The worst-case effect of this uncertainty 
is that it may not be possible to inspect as many damage locations as previously believed. 



Number of 
Damage 
Sites Visited 

Vehicle 

Attitude 

Case 1 

2 

Inertial 

Case 2 

2 

LVLH 

Case 3 

3 

Inertial 

Case 4 

3 

LVLH 


12 

American Institute of Aeronautics and Astronautics 




The unavoidable shortcomings of the PABF and KC-135 made tether retrieval tests mostly inconclusive. 
However, there were some useful lessons to be gleaned from the KC-135 flights. 

1) To reduce uncontrolled spinning, the safety tether cable should be connected to the EMU D-ring on the side 
that will be kept closest to the robotic arm. When tension is applied to the cable, the suit is in a stable 
equilibrium, which reduces rotation. If the cable were connected to the opposite side of the EMU, a tug 
would spin the suit as the far connection point leads the motion. 

2) Before the EVA crewmembers begin pulling the tether, the SAFER pilot should fairlead the cable through a 
glove positioned in front of their chest. This action directs the pull through the EMU’s center of gravity. 
Positioned here, moment arms are minimized and unwanted spin is reduced. This also prepares the 
crewmember to counteract rotation and control their attitude by diverting the cable to either side. A 
clockwise spin can be overcome by holding the cable to one’s right side. Likewise counterclockwise 
rotation is corrected with the cable diverted to the left. It is noteworthy that this technique is less effective 
at controlling pitch and roll because there is a greater moment of inertia about these body axes. Care must 
also be taken to avoid an excessive increase in the linear velocity of the crewmember with each pull. 

Without a testing environment that is sufficiently analogous to space flight, procedure development was forced 
to be somewhat of an unverified mental exercise. The EMU has been certified to withstand impacts at speeds less 
than 1.6 ft/s. Even if SAFER failed such that thrusters fired when uncommanded, the crewmember can detect this 
anomaly and disable the jets before reaching a speed of 0.5 ft/s. Even so, by the time the EMU is pulled within reach 
of the second crewmember it would have accelerated to over 10 ft/s in the worst-case. The only relief to this 
problem can be seen by re-examining Eq. 3. 


R 0 V 0 sin&o= RjVj sinBj (3) 

The magnitude of R decreases when the EMU moves closer to the robotic arm. The initial velocity, V 0 must be 
minimized to prevent excessive speeds during the rescue. This can only be achieved with controlled impacts with 
structure prior pulling the stranded crewmember closer to the robotic arm. Using the cable manipulation techniques 
described above, the SAFER pilot should attempt to orient their body so that they are facing the structure during 
contact. If successful, the crewmember’s hands could dampen the impact and reduce V 0 . The crew may even be able 
to hold onto the vehicle depending upon where the impact happens. There are a couple of key points to remember if 
this procedure is needed. 

1) The astronaut that is tending the tether from the robotic arm should apply the necessary tension to prevent 
the SAFER crewmember from drifting farther away. Contrary to common instinct however, the tether 
should not be retracted. This will cause the stranded EVA crewmember to swing out an arc that will 
eventually bring them to structure. The resultant contact will provide a place to hold, or can be used to 
reduce the angular momentum so that a subsequent cable retraction can be performed. 

2) Controlling the initial velocity at the time of SAFER failure is critical. SAFER training should emphasize 
slow movement and rapid recognition of thruster failures. 

B. Effects of Vehicle Contact Forces 

The tests performed on the KC-135 to capture motion analysis and load cell data were prone to unavoidable 
sources of error, which made it extremely difficult to capture quality data. Despite having performed a dry run of the 
Vicon system on the PABF, three flights worth of motion analysis data was unusable. From the three remaining 
flights, data from only two parabolas were identified as candidates for incorporation in the VR model. Several 
factors listed below were considered in the data reduction process. 

1) The test conductor must not be touching the subject for a period before, during, and after contour gauge 
contact with tile. 

2) The EMU should not exhibit linear or rotational accelerations when not in contact with anything. This 
would be an indication of aircraft turbulence. 

3) The EMU’s center of gravity must be moving at a constant speed less than 0.2 ft/s toward the tile with no 
rotation prior to tool contact. After depth measurement, the EMU can no longer be moving toward the tile 
board. 

4) The body attitude must have a pitch between 20 and 40 degrees with negligible yaw. 

5) Video footage must show that the depth gauge was the only item touching tile. Contact with a second hand, 
helmet or boot would impart a load not recorded by the force sensors. 
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Figures nine and ten show a selection of the motion analysis data set from the test case chosen for use in the 
Virtual Reality model. 



Figure 9. C.G. velocity and tool contact force during KC-135 depth measurement. 



Y Position, ft 

Figure 10. C.G. trajectory in the test X-Y plane 


Unfortunately, when the VR simulation was tested with the force data incorporated into the model, the result was 
not consistent with what was observed during the KC-135 flights. The simulated contact created unrealistically high 
linear and rotational accelerations. A basic conservation of momentum calculation was performed to determine if the 
problem lied in the simulation, or the force data being used as an input. This calculation showed that the physics 
driving the VR model were correct and the problem was resulting from the force data. Most likely, the measured 
loads were unrealistically high due to sensor bias, or non-zero G forces induced by the aircraft. At any rate, the 
development of Charlotte was nearing completion and that system was showing promise. Any attempt to correct the 
problems with the KC-135 force data would be put on hold pending the outcome of the Charlotte trial tests. 
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Incorporating Charlotte into the SAFER flight simulation was amazingly successful. The simulated EMU 
reaction to depth measurement was analogous that seen on the KC-135. The major difference was that the SAFER 
attitude control was now able to affect the flight dynamics. The updated virtual reality model shows that EMU 
rotation resulting from a typical measurement is stabilized by SAFER before large angular displacements occur. The 
motion is not severe enough to cause crewmember disorientation. Despite this, Charlotte has shown that every effort 
must be made to minimize contact force. The propellant consumed to counteract contact is not trivial over the course 
of an inspection mission to multiple damage locations. Excessively strong measurements will result in loss of 
controlled flight. Unlike the prerecorded force plots, Charlotte will teach astronauts the effect of their specific 
measurement technique. This will be instrumental in sensitizing astronauts in the need for a light touch. 

C. Body and Tool Position Awareness 

The air-bearing floor testing that was performed to develop a body position during damage depth measurement 
revealed a surprising result; all astronaut test subjects independently arrived at the same answer. The unanimous 
finding was to position the crewmember such that the angle between the long axis of the EMU’s life support system 
backpack and the tile surface is between 20 and 40 degrees. Although the crewmembers reported that they could not 
see their boots, they were confident that there was enough clearance. An overhead camera and the tile board load 
cell both confirmed that there was no accidental tile contact. These findings were later confirmed during the motion 
analysis flights onboard the KC-135. 

In addition to establishing preferences for body positions, configuration of EVA tools proved equally important. 
The SAFER hand control module protrudes in front of the crewmember. This prevents the mini-workstation T-bar® 
from being fully stowed. If placed in the most upward achievable position, the T-bar will obstruct short-armed 
crewmembers from reaching the tile with the contour gauge. In addition, this T-bar configuration increases the 
chance of inadvertent contact with TPS materials. Therefore, procedures have been written to completely fold the T- 
bar down to avoid these interference issues during inspection. It was found to be wise to minimize the number of 
tools taken to the inspection worksite. This makes one-handed operation easier, and generally simplifies the task. It 
is important to note that the tiles were also tested to determine the extent to which they can withstand accidental 
EVA contact. An EMU boot kick test revealed that tile damage, while possible, was only superficial. Regardless, it 
seems sensible to minimize all unnecessary contact. 

D. Safety Tether Slack Management 

Fortunately, the results for the slack management tests proved very favorable. All crewmembers involved with 
the test agreed that it was a simple job. The average running tension on the cable varied between 0.0 and 0.1 lbs. 
Peak readings were generally about 1 lb. However, the personnel conducting the test were able to feel when the peak 
forces occurred and reported that they were very infrequent with durations less than approximately one quarter 
second. These data indicated that tether tensions were managed to a negligible level. Because of this, it was decided 
to not include tether forces in the virtual reality simulation model. 

E. Effects of Vehicle Attitude and Orbit 

Unlike the other problems addressed so far, the concern over flying SAFER in close proximity to a Space Shuttle 
in an LVLH orbit never jeopardized the feasibility of the project. If the LVLH vehicle attitude were found to be 
unacceptable, it would be possible to impose attitude restrictions on ISS and the Orbiter during SAFER inspection. 
However, these restrictions are certainly undesirable due to the effects on ISS systems. As it turned out, the 
comparative virtual reality tests showed that there was no significant difference between inspections flown with the 
vehicles in LVLH or inertial orbits. On average, the LVLH test cases used 1.4% more nitrogen during gross 
translations, but 1.3% less during approaches. The average duration of LVLH missions was only 59 seconds longer 
over the course of a 22-minute inspection. These difference are considered insignificant and well within the margin 
of error for the test. Additionally, all crewmembers involved with the test agreed that either situation was acceptable. 
These results provide operations flexibility by allowing any vehicle attitude to be flown throughout SAFER flight. 

Although the study proved that the orbit types did not affect consumables or flight duration, the test did verify 
important operational impacts that must be addressed during crew training. As previously discussed, the LVLH orbit 
causes the vehicle to rotate 360 degrees with respect to SAFER over the course of each orbit. This equates to as 
much as 180 degrees of relative rotation during an inspection mission. Unlike SAFER rescue, the close proximity to 
structure inherent in TPS examinations makes this effect relevant. The SAFER pilot needs to be vigilant to correct 


® The mini-workstation T-bar is a device used to stow multiple EVA tools near the astronaut’s chest for easy 
access. The T-bar pitch can be adjusted 135-degrees. 
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attitude deviations. The support EVA crewmember on the robotic arm must also provide verbal assistance to make 
the pilot aware of slow changes in body orientation. A final caution must be expressed regarding the applicability of 
these results. The vehicle attitudes chosen for this test are common for docked phases of flight. However, the 
conclusions may not be valid for all possible attitudes. If a SAFER inspection is ever performed, simulations should 
be repeated with the flight specific attitude and damage locations to ensure that the task is still acceptable. 

VI. Conclusion 

As we looked to the East Texas sky on a Saturday morning in Februaiy, the arms, which held high a banner 
displaying the mantra “Failure is not an option,” began to quiver under the burden of reality. From our loss is bom a 
renewed sense of purpose. The previous success that had come to be considered routine would never again be taken 
for granted. To continue the legacy of human space flight, we must leam from previous mistakes to ensure they are 
never repeated. 

The loss of Columbia and her crew has demonstrated the vulnerability of the Space Shuttle’s Thermal Protection 
System. Inspection capability must exist to verify its integrity after the chaotic launch into orbit. Furthermore, 
backup options must be ready in the event that performance of the primary inspection tools fall short of 
expectations. If we have done our job correctly, SAFER will never be used for inspection. However, preparation for 
contingencies dictates that all obstacles facing the use of SAFER for TPS inspection are investigated to provide this 
capability. 

If failures or other considerations lead to the election of SAFER inspection, the testing and analysis results reveal 
the task to be within the hardware and crew’s capability. Every EVA has operational impacts and hazards. 
Therefore, autonomous and robotic methods should always be preferred over any EVA option. Of the manual 
inspection alternatives, those that provide the greatest stability at the worksite and ease of emergency retreat should 
take precedence. Operational overhead and mission impacts should also be considered for each specific flight. In 
certain situations, SAFER flight will be the best plan, and the operation can be considered sound. 

It should be understood clearly that SAFER inspection is not without risk to the Orbiter and EVA crew. The 
greatest concern is with safety tether retrieval. Great strides have been taken to increase operational reliability 
thereby reducing the chance of performing this procedure. If a tether rescue is conducted, it will be complex and the 
stranded crew will have little body control. However, procedures have been developed to give the crew every 
possible advantage to affect a successful rescue. It should be remembered that this is not a new risk; every EVA is 
exposed to similar dangers when using a safety tether. As has already happened at least three times on orbit, when a 
crewmember loses grasp on a handrail they are dependent upon the safety tether to return them to structure. Such an 
event could easily swing the crew into TPS materials or other equally hazardous areas. One might argue that a tether 
retrieval during SAFER flight is actually less of a risk because the second EV crewmember is prepared to manage 
the extended cable length. 

Human factors play a paramount role in piloting performance. Compared to SAFER rescue flying, the inspection 
tasks are made much easier due to the slow translation speeds and close proximity to structure. The short-range 
flights provide excellent depth perception and relative motion cues. In addition, the added situational awareness 
provided by the second crewmember results in a new level of flight precision. 

A final remark should be voiced on the conclusions drawn in this report. This study is based on the concept for 
vehicle inspection and repair as of September 2004. Over time, operational priorities and risk tolerance may change, 
which may draw into question the acceptability of SAFER inspection. Accordingly, the issues presented should be 
readdressed when this happens to make sure old assumptions are still valid. 
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VII. Afterward 

In the time since the original drafting of this paper there has been a significant breakthrough in EVA TPS 
inspection. Through the use of an imagery analysis technique called photogrammetry, 3D depth measurements can 
be acquired with the digital camera alone. This eliminates the need to contact the vehicle surface during the 
inspection process. SAFER flight is much more stable because there is no longer any reaction force to counteract. 
Propellant consumption is appreciably reduced along with flight duration. Precise body position is no longer as 
critical because the crewmember can remain over five feet away from the vehicle at all times. There is no risk of 
further damage to the delicate TPS materials. Tool management is simplified because the contour gauge is not 
carried to the worksite. This reduces pilot distraction as well as tether entanglement. Finally, the data quality far 
exceeds that which is possible with the contour gauge. 

Photogrammetry has a long history of use in commercial applications. It is used to verify ‘as built’ dimensions 
of manufactured parts. The USGS uses it to create topographical maps of the Earth. NASA has even used 
photogrammetry to measure solar array deflection on ISS and to map the lunar surface. This extensive heritage 
means that the analysis methods and image requirements are well understood. The analysis relies on photographs 
taken from slightly different locations. The shift in perspective is used to perform analytical measurements accurate 
to with +/- 0.05 inches. In much the same way as the old toy stereo-viewers created the perception of a 3D object, 
images of tile damage can be combined such that a cavity can be perceived to have depth when a special pair of 
glasses is donned. CAD models can be generated, and rapid prototypes of the damage tile can be recreated for use in 
Mission Control. Most importantly, the Space Shuttle Damage Assessment Team can get an accurate understanding 
of tile damage regardless of the OBSS functionality. 
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